hfs 3.2.1 → 3.3.0-alpha1

package/src/uploadOwners.js

@@ -0,0 +1,95 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.uploadOwners = exports.ownUploadDeleteHours = void 0;
+exports.setUploadOwner = setUploadOwner;
+exports.moveUploadOwner = moveUploadOwner;
+exports.deleteUploadOwner = deleteUploadOwner;
+exports.getSessionId = getSessionId;
+const kvstorage_1 = require("@rejetto/kvstorage");
+const misc_1 = require("./misc");
+const first_1 = require("./first");
+const config_1 = require("./config");
+const auth_1 = require("./auth");
+const events_1 = __importDefault(require("./events"));
+exports.ownUploadDeleteHours = (0, config_1.defineConfig)(misc_1.CFG.own_upload_delete_hours, 24);
+exports.uploadOwners = new kvstorage_1.KvStorage({
+    rewriteLater: true,
+});
+exports.uploadOwners.open('upload-owners.kv').catch(e => console.error("Upload owners won't work correctly", e));
+(0, first_1.onProcessExit)(() => exports.uploadOwners.close());
+setInterval(() => {
+    if (!exports.uploadOwners.isOpen())
+        return;
+    const keys = Array.from(exports.uploadOwners.keys());
+    for (const k of keys) {
+        const owner = exports.uploadOwners.getSync(k);
+        if (owner && isExpired(owner))
+            void exports.uploadOwners.del(k);
+    }
+}, misc_1.MINUTE);
+events_1.default.on('checkVfsPermission', ({ node, perm, ctx }) => {
+    if (perm !== 'can_delete' || !node.source)
+        return;
+    const { vfsPath } = node;
+    if (!vfsPath || !exports.ownUploadDeleteHours.get() || !exports.uploadOwners.isOpen())
+        return;
+    const owner = exports.uploadOwners.getSync(cleanVfsPath(vfsPath));
+    if (!owner)
+        return;
+    if (isExpired(owner)) {
+        deleteUploadOwner(vfsPath);
+        return;
+    }
+    const username = (0, auth_1.getCurrentUsername)(ctx);
+    const { sessionId } = owner;
+    if (sessionId && sessionId === ctx.session?.sessionId || username && owner.username === username)
+        return 0;
+});
+function setUploadOwner(vfsPath, ctx) {
+    if (!exports.uploadOwners.isOpen() || !exports.ownUploadDeleteHours.get())
+        return;
+    const username = (0, auth_1.getCurrentUsername)(ctx) || undefined;
+    return exports.uploadOwners.put(cleanVfsPath(vfsPath), {
+        username,
+        sessionId: username ? undefined : getSessionId(ctx),
+        ip: ctx.ip,
+        created: new Date(),
+    })?.catch(e => {
+        console.error("Couldn't store upload owner for", vfsPath, String(e.message || e));
+    });
+}
+async function moveUploadOwner(fromPath, toPath) {
+    if (!exports.uploadOwners.isOpen())
+        return;
+    const from = cleanVfsPath(fromPath);
+    const affected = Array.from(exports.uploadOwners.keys()).filter(k => isSameOrInside(from, k));
+    if (!affected.length)
+        return;
+    const to = cleanVfsPath(toPath);
+    const owners = affected.map(k => ({ k, owner: exports.uploadOwners.getSync(k) }));
+    // ownership is keyed by VFS path, so HFS moves must carry descendant upload records too
+    await Promise.all(owners.map(({ k, owner }) => owner && exports.uploadOwners.put(to + k.slice(from.length), owner)));
+    await Promise.all(affected.map(k => exports.uploadOwners.del(k)));
+}
+function deleteUploadOwner(vfsPath) {
+    if (exports.uploadOwners.isOpen())
+        // deleting a folder must clear ownership for uploaded files below it too
+        for (const k of Array.from(exports.uploadOwners.keys()).filter(k => isSameOrInside(cleanVfsPath(vfsPath), k)))
+            void exports.uploadOwners.del(k);
+}
+function isExpired(owner) {
+    const hours = exports.ownUploadDeleteHours.get();
+    return !hours || Number(owner.created) + hours * misc_1.HOUR <= Date.now();
+}
+function getSessionId(ctx) {
+    return ctx.session.sessionId ||= (0, misc_1.randomId)(30);
+}
+function cleanVfsPath(path) {
+    return '/' + path.replace(/^\/+|\/+$/g, '');
+}
+function isSameOrInside(parent, path) {
+    return path === parent || path.startsWith(parent + '/');
+}

package/src/util-files.js

@@ -31,7 +31,7 @@ const const_1 = require("./const");
 const promises_2 = require("stream/promises");
 const stat_1 = require("./stat");
 const unzipper_1 = __importDefault(require("unzipper"));
-const fileTimeout = (0, config_1.defineConfig)('file_timeout', 3, x => x * 1000);
+const fileTimeout = (0, config_1.defineConfig)(cross_1.CFG.file_timeout, 3, x => x * 1000);
 // a smart (and a bit arbitrary) way to decide if we need the stat-workers functionality. Without it, we may be a bit faster. We'll see with experience if we need a dedicated configuration.
 const disableStatWorkers = Number(process.env.UV_THREADPOOL_SIZE) >= 10;
 // some paths (mostly offline networked ones) can take 20+ seconds to fail
@@ -106,7 +106,9 @@ function escapeGlobPath(path) {
 async function unzip(stream, cb) {
     const extracted = new Map();
     let chain = Promise.resolve();
-    return new Promise((resolve, reject) => stream.pipe(unzipper_1.default.Parse())
+    const parser = unzipper_1.default.Parse();
+    stream.once('error', e => parser.destroy(e)); // pipe doesn't forward source errors, so make the parser reject and release its resources
+    return new Promise((resolve, reject) => stream.pipe(parser)
         .on('close', () => chain.then(resolve, reject))
         .on('error', reject)
         .on('entry', (entry) => chain = chain.then(async () => {

package/src/util-http.js

@@ -64,6 +64,7 @@ async function httpWithBody(url, options) {
 function httpStream(url, { body, proxy, jar, noRedirect, httpThrow = true, ...options } = {}, redirected = []) {
     const controller = new AbortController();
     options.signal ??= controller.signal;
+    options.localAddress ??= httpStream.defaultLocalAddress;
     return Object.assign(new Promise(async (resolve, reject) => {
         proxy ??= httpStream.defaultProxy;
         options.headers ??= {};
@@ -140,7 +141,7 @@ function httpStream(url, { body, proxy, jar, noRedirect, httpThrow = true, ...op
         if (options.timeout) // node only emits the timeout event, so destroy the request to unblock callers waiting for the body
             req.setTimeout(options.timeout, () => req.destroy(Object.assign(Error('timeout'), { code: 'ETIMEDOUT' })));
         if (body && body instanceof node_stream_1.Readable)
-            body.pipe(req).on('end', () => req.end());
+            body.on('error', e => req.destroy(e)).pipe(req);
         else
             req.end(body);
         function connect() {
@@ -149,6 +150,7 @@ function httpStream(url, { body, proxy, jar, noRedirect, httpThrow = true, ...op
                 (proxyParsed.protocol === 'https:' ? node_https_1.default : node_http_1.default).request({
                     ...proxyParsed,
                     auth: undefined, // void proxyParsed.auth
+                    localAddress: options.localAddress, // the proxy socket is the actual outbound connection when tunneling HTTPS
                     method: 'CONNECT',
                     path,
                     headers: { Host: path, ...proxyAuth }

package/src/vfs.js

@@ -37,7 +37,12 @@ const comments_1 = require("./comments");
 const walkDir_1 = require("./walkDir");
 const node_stream_1 = require("node:stream");
 const adminApis_1 = require("./adminApis");
-const showHiddenFiles = (0, config_1.defineConfig)('show_hidden_files', false);
+const showHiddenFiles = (0, config_1.defineConfig)(misc_1.CFG.show_hidden_files, false);
+function setVfsPath(node, vfsPath, parent) {
+    return (0, misc_1.setHidden)(node, {
+        vfsPath: (0, misc_1.enforceFinal)('/', parent?.vfsPath) + (0, misc_1.pathEncode)(vfsPath)
+    });
+}
 function permsFromParent(parent, child) {
     const ret = {};
     for (const k of misc_1.PERM_KEYS) {
@@ -81,20 +86,20 @@ function normalizeFilename(x) {
     return (const_1.IS_WINDOWS || const_1.IS_MAC ? x.toLocaleLowerCase() : x).normalize();
 }
 async function applyParentToChild(child, parent, name) {
-    const ret = {
+    name ||= child ? getNodeName(child) : '';
+    const ret = setVfsPath({
         original: child, // this can be overridden by passing an 'original' in `child`
         ...child,
         isFolder: child?.isFolder ?? (child?.children?.length > 0 || undefined), // isFolder is hidden in original node, so we must copy it explicitly
         isTemp: true,
         parent,
-    };
-    name ||= child ? getNodeName(child) : '';
+    }, name, parent);
     inheritMasks(ret, parent, name);
     await parentMaskApplier(parent)(ret, name);
     inheritFromParent(ret);
     return ret;
 }
-async function urlToNode(url, ctx, parent = exports.vfs, allowMissing // true means missing path segments still resolve to temporary nodes with a computed source path
+async function urlToNode(url, ctx, parent = exports.vfs.compiled(), allowMissing // true means missing path segments still resolve to temporary nodes with a computed source path
 ) {
     let initialSlashes = 0;
     while (url[initialSlashes] === '/')
@@ -112,6 +117,7 @@ async function urlToNode(url, ctx, parent = exports.vfs, allowMissing // true me
     const ret = await getNodeByName(name, parent, assumeFolder);
     if (!ret)
         return;
+    setVfsPath(ret, name, parent);
     if (rest || ret?.original)
         return urlToNode(rest, ctx, ret, allowMissing);
     if (ret.source)
@@ -164,7 +170,7 @@ async function getNodeByName(name, parent, assumeMissingToBeFolder = false) {
         return ret;
     }
 }
-const smartUncFolderDetection = (0, config_1.defineConfig)('smart_unc_folder_detection', false);
+const smartUncFolderDetection = (0, config_1.defineConfig)(misc_1.CFG.smart_unc_folder_detection, false);
 async function setIsFolder(node) {
     if (!node.source)
         return;
@@ -174,26 +180,27 @@ async function setIsFolder(node) {
     (0, misc_1.setHidden)(node, { isFolder });
     return isFolder;
 }
-exports.vfs = {};
-(0, config_1.defineConfig)('vfs', exports.vfs).sub(async (x) => {
-    await reviewVfs(x);
+// compiled is the stable mutable tree, while get() may return a fresh clone of the default
+exports.vfs = (0, config_1.defineConfig)(misc_1.CFG.vfs, {}, x => setVfsPath(structuredClone(x && typeof x === 'object' ? x : {}), '')); // ensure the type is right
+exports.vfs.sub(async () => {
+    await reviewVfs();
     console.log('VFS ready');
 });
-async function reviewVfs(data = exports.vfs) {
+async function reviewVfs() {
     await (async function recur(node) {
         if (node.source && !node.children?.length && node.isFolder === undefined)
             await setIsFolder(node);
         if (node.children)
             await Promise.allSettled(node.children.map(recur));
-    })(data);
-    exports.vfs = data;
+    })(exports.vfs.compiled());
 }
 exports.saveVfs = (0, misc_1.debounceAsync)(async () => {
-    await reviewVfs();
-    await (0, config_1.setConfig)({ vfs: exports.vfs }, true);
+    await reviewVfs(); // refresh runtime-derived folder flags before saving mutated VFS state
+    exports.vfs.set(exports.vfs.compiled()); // sync the mutable runtime tree back to config state before persisting it
+    (0, config_1.saveConfigAsap)();
 });
 function isRoot(node) {
-    return node === exports.vfs;
+    return node === exports.vfs.compiled();
 }
 function getNodeName(node) {
     if (isRoot(node))
@@ -266,12 +273,9 @@ function statusCodeForMissingPerm(node, perm, ctx, assign = true) {
         } while (1);
         if ((0, misc_1.isWhoObject)(who) || isWhoVfsPerms(who))
             throw Error(`permission type-guard: ${JSON.stringify(who)}`);
-        const eventName = 'checkVfsPermission';
-        if (events_1.default.anyListener(eventName)) {
-            const first = lodash_1.default.max(events_1.default.emit(eventName, { who, node, perm, ctx }));
-            if (first !== undefined)
-                return first;
-        }
+        const first = lodash_1.default.max(events_1.default.emit('checkVfsPermission', { who, node, perm, ctx }));
+        if (first !== undefined)
+            return first;
         return simpleWhoToError(who, ctx)
             ?? (0, misc_1.throw_)(Error(`invalid permission: ${perm}=${(0, misc_1.try_)(() => JSON.stringify(who))}`));
     }
@@ -306,7 +310,7 @@ async function* walkNode(parent, { ctx, depth = Infinity, prefixPath = '', requi
                 const nodeName = getNodeName(child);
                 const name = prefixPath + nodeName;
                 taken?.add(normalizeFilename(name));
-                const item = { ...child, original: child, name, parent };
+                const item = setVfsPath({ ...child, original: child, name, parent }, name, parent);
                 if (await cantSee(item))
                     return;
                 if (item.source && !item.children?.length) // real items must be accessible, unless there's more to it
@@ -349,7 +353,7 @@ async function* walkNode(parent, { ctx, depth = Infinity, prefixPath = '', requi
                         const name = prefixPath + (renamed || path);
                         if (taken?.has(normalizeFilename(name))) // taken by vfs node above
                             return false; // false just in case it's a folder
-                        const item = { name, isFolder, source: (0, path_1.join)(source, path), parent, stats: entry.stats };
+                        const item = setVfsPath({ name, isFolder, source: (0, path_1.join)(source, path), parent, stats: entry.stats }, name, parent);
                         // masks containing '/' must be matched against the relative path while keeping walkDir recursion enabled
                         await pathMaskApplier(item, renamed || path);
                         if (await cantSee(item)) // can't see: don't produce and don't recur
@@ -482,13 +486,17 @@ events_1.default.on('accountRenamed', ({ from, to }) => {
         if (n.masks)
             Object.values(n.masks).forEach(renameInNode);
         n.children?.forEach(renameInNode);
-    })(exports.vfs);
+    })(exports.vfs.compiled());
     (0, exports.saveVfs)();
     function renameInPerm(a) {
-        if (!Array.isArray(a))
+        if ((0, misc_1.isWhoObject)(a)) {
+            renameInPerm(a.this);
+            renameInPerm(a.children);
             return;
-        for (let i = 0; i < a.length; i++)
-            if (a[i] === from)
-                a[i] = to;
+        }
+        if (Array.isArray(a))
+            for (let i = 0; i < a.length; i++)
+                if (a[i] === from)
+                    a[i] = to;
     }
 });

package/src/walkDir.js

@@ -23,12 +23,12 @@ function walkDir(path, { depth = 0, hidden = true, parallelizeRecursion = false,
     return new Promise(async (resolve, reject) => {
         if (!await (0, util_files_1.isDirectory)(path))
             return reject(Error('ENOTDIR'));
-        dirQ.add(() => readDir('', depth)
+        dirQ.add(() => readDir('', depth, [path])
             .then(res => {
             Promise.resolve(res?.branchDone).then(resolve);
         }, reject));
     });
-    async function readDir(relativePath, depth) {
+    async function readDir(relativePath, depth, ancestorPaths) {
         if (stopped)
             return;
         const base = (0, path_1.join)(path, relativePath);
@@ -39,6 +39,8 @@ function walkDir(path, { depth = 0, hidden = true, parallelizeRecursion = false,
         const pluginReceiver = lodash_1.default.isFunction(res) && res || null;
         const pluginIterator = lodash_1.default.isFunction(res?.[Symbol.asyncIterator] || res?.[Symbol.iterator]) && res;
         if (const_1.IS_WINDOWS && !pluginIterator) { // use native apis to read the 'hidden' attribute
+            // fswin callbacks cannot await, so track their work before closing the branch
+            const entriesWorking = [];
             const direntMethods = {
                 isDir: false,
                 isFile() { return !this.isDir; },
@@ -46,14 +48,16 @@ function walkDir(path, { depth = 0, hidden = true, parallelizeRecursion = false,
                 isBlockDevice() { return false; },
                 isCharacterDevice() { return false; },
             };
-            await new Promise(res => fswin_1.default.find(base + '\\*', (event, f) => {
-                if (event !== 'FOUND')
-                    return res();
+            await new Promise((resolve, reject) => fswin_1.default.find(base + '\\*', (event, f) => {
+                if (event !== 'FOUND') {
+                    Promise.all(entriesWorking).then(() => resolve());
+                    return;
+                }
                 if (stopped)
                     return true; // stop signal
                 if (!hidden && f.IS_HIDDEN)
                     return;
-                work(Object.assign(Object.create(direntMethods), {
+                entriesWorking.push(work(Object.assign(Object.create(direntMethods), {
                     isDir: f.IS_DIRECTORY,
                     name: f.LONG_NAME,
                     stats: {
@@ -63,7 +67,7 @@ function walkDir(path, { depth = 0, hidden = true, parallelizeRecursion = false,
                         isFile: () => !f.IS_DIRECTORY,
                         isDirectory: () => f.IS_DIRECTORY,
                     }
-                }));
+                }), Boolean(f.REPARSE_POINT_TAG)).catch(reject));
             }, true));
         }
         else
@@ -72,7 +76,9 @@ function walkDir(path, { depth = 0, hidden = true, parallelizeRecursion = false,
                     break;
                 if (!hidden && !const_1.IS_WINDOWS && entry.name[0] === '.')
                     continue;
-                const stats = entry.isSymbolicLink?.() && await (0, util_files_1.statWithTimeout)((0, path_1.join)(base, entry.name)).catch(() => null);
+                // stat follows links, so preserve their identity for cycle detection
+                const isSymlink = entry.isSymbolicLink?.();
+                const stats = isSymlink && await (0, util_files_1.statWithTimeout)((0, path_1.join)(base, entry.name)).catch(() => null);
                 if (stats === null)
                     continue;
                 if (stats)
@@ -80,7 +86,7 @@ function walkDir(path, { depth = 0, hidden = true, parallelizeRecursion = false,
                 const expanded = entry;
                 if (stats)
                     expanded.stats = stats;
-                await work(expanded);
+                await work(expanded, isSymlink);
             }
         pluginReceiver?.(!stopped);
         const branchDone = Promise.allSettled(subDirsDone);
@@ -90,7 +96,7 @@ function walkDir(path, { depth = 0, hidden = true, parallelizeRecursion = false,
             closingQ.push(relativePath); // ok, we'll ask next one to carry this info
         // don't return the promise directly, as this job ends here, but communicate to caller the promise for the whole branch
         return { branchDone, n };
-        async function work(entry) {
+        async function work(entry, isSymlink = false) {
             entry.path = (relativePath && relativePath + '/') + entry.name;
             pluginReceiver?.(entry);
             if (last && closingQ.length) // pending entries
@@ -104,9 +110,16 @@ function walkDir(path, { depth = 0, hidden = true, parallelizeRecursion = false,
             n++;
             if (!depth || !entry.isDirectory())
                 return;
+            const entryPath = (0, path_1.join)(base, entry.name);
+            if (isSymlink) {
+                // compare only with ancestors so separate links to the same folder still work
+                const [target, ...ancestors] = await Promise.all([entryPath, ...ancestorPaths].map(x => (0, promises_1.realpath)(x).catch(() => '')));
+                if (!target || ancestors.includes(target))
+                    return;
+            }
             const branchDone = (0, cross_1.pendingPromise)(); // per-job
             subDirsDone.push(branchDone);
-            const job = () => readDir(entry.path, depth - 1) // recur
+            const job = () => readDir(entry.path, depth - 1, [...ancestorPaths, entryPath]) // recur
                 .then(x => x, () => { }) // mute errors
                 .then(res => {
                 if (!res?.n)

package/src/watchLoad.js

@@ -12,8 +12,9 @@ const debounceAsync_1 = require("./debounceAsync");
 const events_1 = require("./events");
 function watchLoad(path, parser, { failedOnFirstAttempt, immediateFirst } = {}) {
     let doing = false;
+    let cancelled = false;
     let watcher;
-    const debounced = (0, debounceAsync_1.debounceAsync)(load, { wait: 500, maxWait: 1000, reuseRunning: true });
+    const debounced = (0, debounceAsync_1.debounceAsync)(load, { wait: 500, maxWait: 1000, reuseRunning: true, cancelable: true });
     let retry;
     let last;
     const emitter = new events_1.BetterEventEmitter();
@@ -27,6 +28,8 @@ function watchLoad(path, parser, { failedOnFirstAttempt, immediateFirst } = {})
     install(true);
     return { unwatch, save, emitter, getText: () => last, getPath: () => path };
     function install(first = false) {
+        if (cancelled)
+            return;
         try {
             watcher = (0, fs_1.watch)(path, () => {
                 if (!save.isWorking())
@@ -43,6 +46,12 @@ function watchLoad(path, parser, { failedOnFirstAttempt, immediateFirst } = {})
         }
     }
     function unwatch() {
+        // a pending or running load must not resurrect a watcher cancelled by its owner
+        cancelled = true;
+        debounced.cancel();
+        closeWatcher();
+    }
+    function closeWatcher() {
         watcher?.close();
         clearTimeout(retry);
         watcher = undefined;
@@ -61,12 +70,14 @@ function watchLoad(path, parser, { failedOnFirstAttempt, immediateFirst } = {})
                     return '';
                 throw e;
             });
+            if (cancelled)
+                return;
             if (text === last)
                 return;
             last = text;
             emitter.emit('change', last);
             console.debug('Loaded', path);
-            unwatch();
+            closeWatcher();
             install(); // reinstall, as the original file could have been renamed. We watch by the name.
             await parser(text);
         }

package/src/webdav.js

@@ -24,6 +24,7 @@ const expiringCache_1 = require("./expiringCache");
 const fast_xml_parser_1 = require("fast-xml-parser");
 const lodash_1 = __importDefault(require("lodash"));
 const fileAttr_1 = require("./fileAttr");
+const uploadOwners_1 = require("./uploadOwners");
 const forceWebdavLogin = (0, config_1.defineConfig)(cross_1.CFG.force_webdav_login, true, compileWebdavAgentRegex);
 const webdavInitialAuth = (0, config_1.defineConfig)(cross_1.CFG.webdav_initial_auth, 'WebDAVFS', compileWebdavAgentRegex);
 const webdavPrompted = (0, expiringCache_1.expiringCache)(cross_1.DAY);
@@ -151,6 +152,7 @@ const webdav = async (ctx, next) => {
             if (node?.source)
                 await (0, promises_1.rm)(node.source)
                     .then(() => (0, fileAttr_1.deleteStoredFileAttrs)(node.source))
+                    .then(() => (0, uploadOwners_1.deleteUploadOwner)(path))
                     .catch(() => { });
         }
         if (x && ctx.length === undefined) // missing length can make PUT fail
@@ -206,7 +208,7 @@ const webdav = async (ctx, next) => {
         if ((0, path_1.dirname)(path) === (0, path_1.dirname)(dest)) // rename case. `path` is is encoded, so we test before decoding `dest`
             try {
                 // decode the single path segment so reserved chars like %2C become their real name on rename
-                await (0, frontEndApis_1.requestedRename)(node, (0, cross_1.safeDecodeURIComponent)((0, path_1.basename)(dest), ''), ctx);
+                await (0, frontEndApis_1.requestedRename)(node, (0, cross_1.safeDecodeURIComponent)((0, path_1.basename)(dest), ''), ctx, path);
                 releaseWebdavLock(path); // RFC 4918 says MOVE must not carry locks to destination, so clear source lock on success
                 return ctx.status = cross_1.HTTP_CREATED;
             }
@@ -246,6 +248,18 @@ const webdav = async (ctx, next) => {
     }
     async function handleLock() {
         setWebdavHeaders();
+        // a lock reserves a future write, so authorize it against the existing resource or its parent
+        const node = await (0, vfs_1.urlToNode)(path, ctx);
+        const permissionNode = node || await (0, vfs_1.urlToNode)((0, path_1.dirname)(path), ctx);
+        if (!permissionNode)
+            return ctx.status = cross_1.HTTP_CONFLICT;
+        const missingWritePerm = node && canOverwrite.has(path + (0, cross_1.prefix)('|', (0, auth_1.getCurrentUsername)(ctx))) ? 0
+            : (0, vfs_1.statusCodeForMissingPerm)(permissionNode, node ? 'can_delete' : 'can_upload', ctx);
+        if (missingWritePerm) {
+            if (ctx.status === cross_1.HTTP_UNAUTHORIZED)
+                setWebdavHeaders(true);
+            return;
+        }
         const body = ctx.length || ctx.get('content-length') || ctx.get('transfer-encoding') ? await (0, consumers_1.text)(ctx.req) : '';
         const token = getProvidedLockToken();
         let seconds = Number(ctx.get('timeout').split(',').find(x => /^Second-\d+$/i.test(x.trim()))?.trim().split('-', 2)[1]);
@@ -321,13 +335,13 @@ const webdav = async (ctx, next) => {
             res.write(`<response>
               <href>${lodash_1.default.escape(outPath + (append ? (0, cross_1.pathEncode)(name, true) + (isDir ? '/' : '') : ''))}</href>
               <propstat>
-                <status>HTTP/1.1 200 OK</status>
                 <prop>
                     ${(0, cross_1.prefix)('<getlastmodified>', st?.mtime?.toGMTString(), '</getlastmodified>')}
                     ${(0, cross_1.prefix)('<creationdate>', (st?.birthtime || st?.ctime)?.toISOString().replace(/\..*/, '-00:00'), '</creationdate>')}
                     ${isDir ? '<resourcetype><collection/></resourcetype>'
                 : `<resourcetype/><getcontentlength>${st?.size}</getcontentlength>`}
                 </prop>
+                <status>HTTP/1.1 200 OK</status>
               </propstat>
               </response>
             `);

package/src/zip.js

@@ -39,8 +39,9 @@ async function zipStreamFromFolder(node, ctx) {
                     continue;
                 if ((0, vfs_1.nodeIsFolder)(subNode)) { // a directory needs to be walked
                     if ((0, vfs_1.hasPermission)(subNode, 'can_list', ctx) && (0, vfs_1.hasPermission)(subNode, 'can_archive', ctx)) {
-                        yield subNode; // it could be empty
-                        yield* (0, vfs_1.walkNode)(subNode, { ctx, prefixPath: (0, misc_1.pathDecodeSegments)(uri) + '/', requiredPerm: 'can_archive' });
+                        const archivePath = (0, misc_1.pathDecodeSegments)(uri);
+                        yield { ...subNode, name: archivePath }; // keep empty selected folders at the same path used for their contents
+                        yield* (0, vfs_1.walkNode)(subNode, { ctx, prefixPath: archivePath + '/', requiredPerm: 'can_archive' });
                     }
                     continue;
                 }
@@ -93,4 +94,4 @@ async function zipStreamFromFolder(node, ctx) {
     ctx.state.archive = 'zip';
     (0, serveFile_1.monitorAsDownload)(ctx, size, range?.start);
 }
-const zipSeconds = (0, config_1.defineConfig)('zip_calculate_size_for_seconds', 5);
+const zipSeconds = (0, config_1.defineConfig)(misc_1.CFG.zip_calculate_size_for_seconds, 5);